CVE-2014-4943

Published: Jul 19, 2014Modified: May 6, 2026

6.9

Vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 3.4 / Impact: 10.0

Source: NVD

Description

The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 allows local users to gain privileges by leveraging data-structure differences between an l2tp socket and an inet socket.

Affected (13)

Products: Linux: Linux Kernel · Opensuse: Opensuse · Suse: Linux Enterprise Desktop, Linux Enterprise Server · +2 more

Show all products

Linux: Linux Kernel · Opensuse: Opensuse · Suse: Linux Enterprise Desktop, Linux Enterprise Server · Redhat: Enterprise Linux Server Aus · Debian: Debian Linux

1 product

1 product

2 products

Linux Enterprise Desktop

Linux Enterprise Server

Redhat

1 product

Enterprise Linux Server Aus

Debian

1 product

Debian Linux

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	From 2.6.23 to 3.2.62
Linux Linux Kernel	From 3.11 to 3.12.27
Linux Linux Kernel	From 3.13 to 3.14.16
Linux Linux Kernel	From 3.15 to 3.15.9
Linux Linux Kernel	From 3.3 to 3.4.102
Linux Linux Kernel	From 3.5 to 3.10.52

Configuration B

5 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 11.4
Suse Linux Enterprise Desktop	Version 11 sp3
Suse Linux Enterprise Server	Version 11 sp2
Suse Linux Enterprise Server	Version 11 sp3
Suse Linux Enterprise Server	Version 11 sp3

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux Server Aus	Version 6.2

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 7.0

Related CWEs

CWE-269

Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

References (46)

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=3cf521f7dc87c031617fd47e4b7aa2593c2f3daf

Source: cve@mitre.org

Broken LinkThird Party Advisory

http://linux.oracle.com/errata/ELSA-2014-0924.html

Source: cve@mitre.org

Third Party Advisory

http://linux.oracle.com/errata/ELSA-2014-3047.html

Source: cve@mitre.org

Third Party Advisory

http://linux.oracle.com/errata/ELSA-2014-3048.html

Source: cve@mitre.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00006.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00007.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://openwall.com/lists/oss-security/2014/07/17/1

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://osvdb.org/show/osvdb/109277

Source: cve@mitre.org

Broken Link

http://rhn.redhat.com/errata/RHSA-2014-1025.html

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/59790

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/60011

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/60071

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/60220

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/60380

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/60393

Source: cve@mitre.org

Third Party Advisory

http://www.debian.org/security/2014/dsa-2992

Source: cve@mitre.org

Third Party Advisory

http://www.exploit-db.com/exploits/36267

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1030610

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://bugzilla.redhat.com/show_bug.cgi?id=1119458

Source: cve@mitre.org

Issue TrackingThird Party Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/94665

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://github.com/torvalds/linux/commit/3cf521f7dc87c031617fd47e4b7aa2593c2f3daf

Source: cve@mitre.org

PatchThird Party Advisory

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=3cf521f7dc87c031617fd47e4b7aa2593c2f3daf